forked from alibaba/nacos
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'develop' into feature_multi_tenant
- Loading branch information
Showing
37 changed files
with
1,186 additions
and
50 deletions.
There are no files selected for viewing
42 changes: 42 additions & 0 deletions
42
config/src/main/java/com/alibaba/nacos/config/server/model/User.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| /* | ||
| * Copyright 1999-2018 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.alibaba.nacos.config.server.model; | ||
|
|
||
| /** | ||
| * user info | ||
| * | ||
| * @author wfnuser | ||
| */ | ||
| public class User { | ||
| private String username; | ||
| private String password; | ||
|
|
||
| public String getPassword() { | ||
| return password; | ||
| } | ||
|
|
||
| public void setPassword(String password) { | ||
| this.password = password; | ||
| } | ||
|
|
||
| public String getUsername() { | ||
| return username; | ||
| } | ||
|
|
||
| public void setUsername(String username) { | ||
| this.username = username; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
107 changes: 107 additions & 0 deletions
107
console/src/main/java/com/alibaba/nacos/console/config/WebSecurityConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| /* | ||
| * Copyright 1999-2018 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.alibaba.nacos.console.config; | ||
|
|
||
| import com.alibaba.nacos.console.filter.JwtAuthenticationTokenFilter; | ||
| import com.alibaba.nacos.console.security.CustomUserDetailsServiceImpl; | ||
| import com.alibaba.nacos.console.security.JwtAuthenticationEntryPoint; | ||
| import com.alibaba.nacos.console.utils.JwtTokenUtils; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.core.env.Environment; | ||
| import org.springframework.security.authentication.AuthenticationManager; | ||
| import org.springframework.security.config.BeanIds; | ||
| import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; | ||
| import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; | ||
| import org.springframework.security.config.annotation.web.builders.HttpSecurity; | ||
| import org.springframework.security.config.annotation.web.builders.WebSecurity; | ||
| import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; | ||
| import org.springframework.security.config.http.SessionCreationPolicy; | ||
| import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; | ||
| import org.springframework.security.crypto.password.PasswordEncoder; | ||
| import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; | ||
|
|
||
| /** | ||
| * Spring security config | ||
| * | ||
| * @author Nacos | ||
| */ | ||
| @Configuration | ||
| @EnableGlobalMethodSecurity(prePostEnabled = true) | ||
| public class WebSecurityConfig extends WebSecurityConfigurerAdapter { | ||
|
|
||
| public static final String AUTHORIZATION_HEADER = "Authorization"; | ||
|
|
||
| public static final String AUTHORIZATION_TOKEN = "access_token"; | ||
|
|
||
| public static final String SECURITY_IGNORE_URLS_SPILT_CHAR = ","; | ||
|
|
||
| @Autowired | ||
| private CustomUserDetailsServiceImpl userDetailsService; | ||
|
|
||
| @Autowired | ||
| private JwtAuthenticationEntryPoint unauthorizedHandler; | ||
|
|
||
| @Autowired | ||
| private JwtTokenUtils tokenProvider; | ||
|
|
||
| @Autowired | ||
| private Environment env; | ||
|
|
||
| @Bean(name = BeanIds.AUTHENTICATION_MANAGER) | ||
| @Override | ||
| public AuthenticationManager authenticationManagerBean() throws Exception { | ||
| return super.authenticationManagerBean(); | ||
| } | ||
|
|
||
| @Override | ||
| protected void configure(AuthenticationManagerBuilder auth) throws Exception { | ||
| auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); | ||
| } | ||
|
|
||
| @Override | ||
| public void configure(WebSecurity web) { | ||
| String ignoreURLs = env.getProperty("nacos.security.ignore.urls", "/**"); | ||
| for (String ignoreURL : ignoreURLs.trim().split(SECURITY_IGNORE_URLS_SPILT_CHAR)) { | ||
| web.ignoring().antMatchers(ignoreURL.trim()); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| protected void configure(HttpSecurity http) throws Exception { | ||
| http | ||
| .authorizeRequests() | ||
| .anyRequest().authenticated().and() | ||
| // custom token authorize exception handler | ||
| .exceptionHandling() | ||
| .authenticationEntryPoint(unauthorizedHandler).and() | ||
| // since we use jwt, session is not necessary | ||
| .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() | ||
| // since we use jwt, csrf is not necessary | ||
| .csrf().disable(); | ||
| http.addFilterBefore(new JwtAuthenticationTokenFilter(tokenProvider), UsernamePasswordAuthenticationFilter.class); | ||
|
|
||
| // disable cache | ||
| http.headers().cacheControl(); | ||
| } | ||
|
|
||
| @Bean | ||
| public PasswordEncoder passwordEncoder() { | ||
| return new BCryptPasswordEncoder(); | ||
| } | ||
|
|
||
| } |
82 changes: 82 additions & 0 deletions
82
console/src/main/java/com/alibaba/nacos/console/controller/AuthController.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| /* | ||
| * Copyright 1999-2018 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.alibaba.nacos.console.controller; | ||
|
|
||
| import com.alibaba.nacos.console.config.WebSecurityConfig; | ||
| import com.alibaba.nacos.config.server.model.RestResult; | ||
| import com.alibaba.nacos.console.utils.JwtTokenUtils; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.security.authentication.AuthenticationManager; | ||
| import org.springframework.security.authentication.BadCredentialsException; | ||
| import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; | ||
| import org.springframework.security.core.Authentication; | ||
| import org.springframework.security.core.context.SecurityContextHolder; | ||
| import org.springframework.web.bind.annotation.*; | ||
| import javax.servlet.http.HttpServletRequest; | ||
| import javax.servlet.http.HttpServletResponse; | ||
|
|
||
| /** | ||
| * auth | ||
| * | ||
| * @author wfnuser | ||
| */ | ||
| @RestController("auth") | ||
| @RequestMapping("/v1/auth") | ||
| public class AuthController { | ||
|
|
||
| @Autowired | ||
| private JwtTokenUtils jwtTokenUtils; | ||
| @Autowired | ||
| private AuthenticationManager authenticationManager; | ||
|
|
||
| /** | ||
| * Whether the Nacos is in broken states or not, and cannot recover except by being restarted | ||
| * | ||
| * @return HTTP code equal to 200 indicates that Nacos is in right states. HTTP code equal to 500 indicates that | ||
| * Nacos is in broken states. | ||
| */ | ||
|
|
||
| @ResponseBody | ||
| @RequestMapping(value = "login", method = RequestMethod.POST) | ||
| public RestResult<String> login(HttpServletRequest request, HttpServletResponse response) throws Exception { | ||
| String username = request.getParameter("username"); | ||
| String password = request.getParameter("password"); | ||
|
|
||
| // 通过用户名和密码创建一个 Authentication 认证对象，实现类为 UsernamePasswordAuthenticationToken | ||
| UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password); | ||
| RestResult<String> rr = new RestResult<String>(); | ||
|
|
||
| try { | ||
| //通过 AuthenticationManager（默认实现为ProviderManager）的authenticate方法验证 Authentication 对象 | ||
| Authentication authentication = authenticationManager.authenticate(authenticationToken); | ||
| //将 Authentication 绑定到 SecurityContext | ||
| SecurityContextHolder.getContext().setAuthentication(authentication); | ||
| //生成Token | ||
| String token = jwtTokenUtils.createToken(authentication); | ||
| //将Token写入到Http头部 | ||
| response.addHeader(WebSecurityConfig.AUTHORIZATION_HEADER, "Bearer " + token); | ||
| rr.setCode(200); | ||
| rr.setData("Bearer " + token); | ||
| return rr; | ||
| } catch (BadCredentialsException authentication) { | ||
| rr.setCode(401); | ||
| rr.setMessage("Login failed"); | ||
| return rr; | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.